Configure. Analyze. Automate.

Cisco IOS Base / Day-0 Config

Config · Cisco IOS

Complete day-zero configuration for Cisco IOS/IOS-XE routers and switches. Includes hostname, domain, users, NTP, DNS, logging, SSH, SNMP, and login banner.

Cisco IOS VLAN Configuration

Config · Cisco IOS

Generate VLAN configuration with access and trunk ports for Cisco IOS/IOS-XE switches. Includes VLAN database, SVI interfaces, access ports, and trunk links.

Cisco IOS Multi-area OSPF

Config · Cisco IOS

Multi-area OSPF configuration with route summarization, stub/NSSA areas, redistribution, and passive interfaces for Cisco IOS/IOS-XE routers.

BGP Advanced Configuration — Cisco IOS / IOS-XE

Config · Cisco IOS

Generate advanced BGP configurations for Cisco IOS/IOS-XE including route reflectors, confederations, route policies, multipath, BFD, and VPNv4.

Cisco ASA Base / Day-0 Configuration

Config · Cisco ASA

Initial hardened configuration for a Cisco ASA firewall: hostname, domain, enable password, SSH access, AAA, NTP, logging, and management interface.

Palo Alto PAN-OS Base / Day-0 Config

Config · Palo Alto

Day-zero configuration for Palo Alto Networks firewalls: hostname, management interface, DNS, NTP, admin users, and basic system settings via CLI set commands.

Cisco ASA NAT Configuration

Config · Cisco ASA

Configure NAT on a Cisco ASA: dynamic PAT for outbound internet access, static NAT for DMZ servers, and NAT exemption for VPN traffic.

Cisco IOS ACL Configuration

Config · Cisco IOS

Named extended and standard ACLs with interface application for Cisco IOS/IOS-XE. Includes object-group references and time-based ACE support.

Cisco ASA Firewall Policy Rule

Config · Cisco ASA

Configure a firewall policy rule on Cisco ASA: define source/destination zones, IPs, service port, and action. Includes NAT reminder when source is RFC1918.

Cisco NX-OS Base / Day-0 Config

Config · Cisco NX-OS

Day-zero configuration for Cisco Nexus switches: hostname, features, users, management interface, NTP, DNS, syslog, and SSH.

Palo Alto Security Zones & Policies

Config · Palo Alto

Zone-based security policy configuration for Palo Alto firewalls: zones, Layer 3 interfaces, address objects, and security rules with App-ID and User-ID.

Fortinet FortiGate Base / Day-0 Config

Config · Fortinet

Day-zero configuration for FortiGate firewalls: hostname, admin, NTP, DNS, management interface, and FortiGuard settings via FortiOS CLI.

Cisco IOS Site-to-Site IPSec VPN

Config · Cisco IOS

IKEv1 or IKEv2 site-to-site IPSec VPN tunnel between two Cisco IOS/IOS-XE routers. Generates crypto policy, keyring, profile, transform-set, ACL, and crypto map.

Cisco ASA Site-to-Site VPN (IPsec IKEv2)

Config · Cisco ASA

Site-to-site IPsec VPN configuration between two Cisco ASA firewalls using IKEv2 — the modern, more secure replacement for IKEv1.

Palo Alto NAT Rules

Config · Palo Alto

Source NAT (masquerade / IP pool), Destination NAT (DNAT/port-forwarding), and static NAT rules for Palo Alto PAN-OS firewalls.

Fortinet FortiGate Firewall Policies

Config · Fortinet

FortiGate security policy configuration with address objects, service objects, UTM profiles, and IPv4 firewall policies.

Cisco NX-OS VLAN & Switchport Config

Config · Cisco NX-OS

VLAN database, SVI interfaces, trunk and access switchport configuration for Cisco Nexus switches.

Cisco ASA AnyConnect SSL VPN

Config · Cisco ASA

Configure Cisco AnyConnect SSL VPN on an ASA for remote user access — the most common remote access VPN solution in enterprise environments.

Cisco IOS Port-Channel / LACP

Config · Cisco IOS

LACP EtherChannel (802.3ad) port-channel configuration for Cisco IOS/IOS-XE switches and routers. Supports L2 (trunk/access) and L3 (routed) port-channels.

Arista EOS Base / Day-0 Config

Config · Arista

Day-zero configuration for Arista switches and routers: hostname, users, management interface, NTP, DNS, SNMP, eAPI, and ZTP disable.

Palo Alto Site-to-Site IPSec VPN

Config · Palo Alto

IKEv2 site-to-site IPSec VPN tunnel on Palo Alto PAN-OS. Generates IKE crypto profile, IPSec crypto profile, IKE gateway, IPSec tunnel, and tunnel interface.

Fortinet FortiGate Interface & VLAN Config

Config · Fortinet

Physical interfaces, VLAN sub-interfaces, loopbacks, and aggregate (LACP) interface configuration for FortiGate firewalls.

Cisco NX-OS vPC Configuration

Config · Cisco NX-OS

Virtual Port-Channel (vPC) domain configuration for Cisco Nexus switches: peer-link, keepalive, peer-gateway, and vPC member port-channels.

Cisco NX-OS OSPF Configuration

Config · Cisco NX-OS

OSPF underlay or overlay routing for Cisco Nexus switches. Supports named OSPF instances, point-to-point links, BFD, and multi-area configuration.

Palo Alto Security Hardening

Config · Palo Alto

PAN-OS security hardening aligned with Palo Alto best practices and CIS Benchmarks: admin access, SSL/TLS, SNMP, management plane restrictions, and security profile defaults.

Fortinet FortiGate NAT Configuration

Config · Fortinet

Central SNAT (source NAT pool), VIP (virtual IP / DNAT port-forwarding), and NAT policies for FortiGate firewalls.

Juniper JunOS Base / Day-0 Config

Config · Juniper

Day-zero configuration for Juniper routers and switches: hostname, root password, system services, NTP, DNS, syslog, SNMP, and management interface via JunOS set commands.

Cisco IOS Security Hardening

Config · Cisco IOS

CIS Benchmark and NSA/NIST-aligned security hardening checklist for Cisco IOS/IOS-XE. Covers AAA, SSH, login protection, management plane, and service hardening.

BGP EVPN / VXLAN Fabric — Cisco NX-OS (Spine-Leaf)

Config · Cisco NX-OS

Generate a complete VXLAN BGP EVPN spine-leaf fabric configuration for Cisco NX-OS (Nexus 9000). Supports iBGP with Route-Reflector spines, symmetric IRB, distributed anycast gateway, vPC with Fabric Peering, and Multi-Site Border Gateway.

Fortinet FortiGate Site-to-Site IPSec VPN

Config · Fortinet

IKEv2 site-to-site IPSec VPN for FortiGate: phase1/phase2 proposals, tunnel interface, static route, and firewall policy for VPN traffic.

Arista EOS BGP Configuration

Config · Arista

eBGP and iBGP routing for Arista EOS with peer groups, route-maps, prefix-lists, communities, and multi-path ECMP support.

Cisco ASA Active/Standby Failover (HA)

Config · Cisco ASA

Configure Active/Standby High Availability failover between two Cisco ASA units — stateful failover preserves existing connections during a switchover.

Arista EOS VLAN & Switchport Config

Config · Arista

VLAN database, SVI interfaces with VRRP, trunk and access switchport configuration for Arista switches running EOS.

Cisco NX-OS Port-Channel / LACP

Config · Cisco NX-OS

LACP port-channel configuration for Cisco Nexus switches. Supports L2 trunk/access and L3 routed port-channels, with optional vPC membership.

Palo Alto HA (Active/Passive or Active/Active)

Config · Palo Alto

High Availability configuration for Palo Alto PAN-OS firewalls: HA1 control link, HA2 data link, passive link state, preemption, and session synchronization.

Juniper JunOS Multi-area OSPF

Config · Juniper

Multi-area OSPFv2 configuration for Juniper routers: areas, stub/NSSA, route summarization, authentication, and redistribution via JunOS set commands.

Juniper JunOS Firewall Filter (ACL)

Config · Juniper

Stateless packet filtering on JunOS: term-based filters, loopback protection for the routing engine, policers for rate limiting, and apply-path for dynamic prefix lists.

Cisco IOS SNMP & Syslog Monitoring

Config · Cisco IOS

SNMP v2c and v3 configuration with trap hosts, syslog remote logging, and NetFlow/IP SLA stubs for Cisco IOS/IOS-XE.

Fortinet FortiGate Security Hardening

Config · Fortinet

CIS Benchmark-aligned hardening for FortiGate firewalls: admin access restrictions, TLS policy, password policy, unused service disablement, and audit logging.

FlexVPN Site-to-Site — Cisco IOS/IOS-XE

Config · Cisco IOS

IKEv2-based FlexVPN site-to-site tunnel with Dynamic VTI (hub) or Static VTI (spoke). The successor to DMVPN — supports per-spoke QoS, VRF-aware tunnels, and dynamic routing. Requires IOS 15.2+.

Cisco ASA Security Hardening

Config · Cisco ASA

CIS-aligned hardening template for Cisco ASA: disable unused services, enforce strong SSH/TLS, enable threat detection, configure logging, and lock down management access.

Palo Alto BGP Configuration

Config · Palo Alto

BGP configuration under a PAN-OS virtual router with eBGP/iBGP peers, import/export policy, prefix filtering, and route-map equivalents via PAN-OS route filters.

Juniper JunOS BGP (eBGP / iBGP / RR)

Config · Juniper

eBGP and iBGP configuration for Juniper JunOS with route reflectors, peer groups, communities, import/export policies, and prefix-list filters.

Arista EOS OSPF Configuration

Config · Arista

OSPFv2 configuration for Arista EOS: process, router-id, multi-area support, BFD, passive interfaces, and redistribution.

Fortinet FortiGate HA Cluster

Config · Fortinet

FortiGate FGCP (FortiGate Clustering Protocol) HA configuration for Active/Passive or Active/Active mode with session synchronization, heartbeat interfaces, and failover settings.

Juniper JunOS VLAN & Layer 2 Switching

Config · Juniper

VLAN configuration with IRB (Integrated Routing and Bridging) interfaces, access/trunk switchports, and RSTP for Juniper EX series switches.

Palo Alto URL Filtering & App-ID Policies

Config · Palo Alto

URL filtering profiles, custom URL categories, application-based security rules, and SSL inspection policy for Palo Alto PAN-OS.

Cisco ASA Object Groups & Service Objects

Config · Cisco ASA

Define reusable network objects, service objects, and object-groups on a Cisco ASA to simplify ACL management and reduce configuration complexity.

Cisco NX-OS Security Hardening

Config · Cisco NX-OS

Security hardening for Cisco Nexus: AAA, SSH hardening, role-based access, CoPP, disable unnecessary services, and management plane protection.

Arista EOS MLAG Configuration

Config · Arista

Multi-chassis Link Aggregation Group (MLAG) for Arista EOS switches: peer-link, keepalive (management), MLAG domain, and MLAG port-channels.

Juniper JunOS Site-to-Site IPSec VPN

Config · Juniper

IKEv2 site-to-site IPSec VPN for Juniper SRX firewalls: IKE proposal/policy/gateway, IPSec proposal/policy/VPN, tunnel interface, and security zone/policy binding.

Fortinet FortiGate BGP Configuration

Config · Fortinet

BGP routing configuration for FortiGate: eBGP and iBGP peers, route-maps, prefix lists, redistribution, and community settings via FortiOS CLI.

BGP Advanced Configuration — Cisco IOS XR

Config · Cisco IOS XR

Generate carrier-grade BGP configurations for Cisco IOS XR (ASR 9000, Cisco 8000, NCS) using RPL route-policies, neighbor-groups, session-groups, and graceful maintenance.

Network Path Analyzer

Script · Troubleshooting

A traceroute shows you less than half the path. Layer 2 switches never appear in one because they do not decrement TTL, and a firewall that happily forwards your probe can still be dropping the port you care about -- the probe is ICMP or UDP and matches a different rule. This walks the real path for one flow, from the source's own gateway so the path is the one that traffic takes, enters every device on it, and names the hop that hurts: the saturated uplink, the access port throwing CRCs, the link that flapped at 3am, or the rule that denies the traffic, by name. Counters are read by cause rather than listed -- CRC is the cable, late collisions are a duplex mismatch, output drops are not an error at all -- and the age of those counters is printed beside them, because a total is not a rate. Pivots to the HSRP or VRRP active member on its own, and a field it could not read prints as a dash, never as a zero.

Cisco IOS XR SNMP & Syslog Configuration

Config · Cisco IOS XR

SNMP v2c and v3 with traps, syslog forwarding, and NetFlow export configuration for Cisco IOS XR routers. Covers NMS integration and operational visibility.

Cisco NX-OS SNMP & Syslog

Config · Cisco NX-OS

SNMPv3 and syslog configuration for Cisco Nexus switches, including trap hosts, NTP, and NXOS-specific logging features.

Juniper JunOS Security Hardening

Config · Juniper

JunOS security hardening: SSH lockdown, AAA with RADIUS/TACACS+, management plane filter, login restrictions, unused service disablement, and firewall filter for loopback.

Arista EOS VXLAN EVPN (Leaf-Spine)

Config · Arista

VXLAN EVPN leaf-spine fabric for Arista EOS: eBGP underlay with OSPF, VTEP (VXLAN interface), BGP EVPN address family, L2VNI and L3VNI per tenant VRF.

Cisco ASA SNMP & Syslog Configuration

Config · Cisco ASA

Configure SNMP v2c/v3 and syslog on a Cisco ASA for monitoring and centralized logging with NMS and SIEM integration.

Juniper JunOS IS-IS & Segment Routing

Config · Juniper

IS-IS Level 1/2 routing with Segment Routing MPLS (SR-MPLS) and traffic-engineering extensions for Juniper MX/PTX routers. Includes SRGB configuration and prefix-SIDs.

Arista EOS Security Hardening

Config · Arista

CIS-aligned security hardening for Arista EOS: password policy, management ACL, SSH restrictions, AAA with TACACS+, disable unused services, and control-plane hardening.

Cisco IOS XR Base Configuration

Config · Cisco IOS XR

Foundational configuration for Cisco IOS XR routers (ASR 9000, NCS 5500, CRS). Covers hostname, AAA, SSH, management VRF, NTP, and syslog.

Juniper JunOS MPLS L3VPN

Config · Juniper

MPLS L3VPN configuration for Juniper MX routers: LDP or RSVP label distribution, VRF instances with PE-CE routing (BGP/OSPF/static), and VPNv4 route reflectors.

Arista EOS SNMP & Syslog Monitoring

Config · Arista

SNMPv2c and SNMPv3 configuration with trap hosts, syslog remote logging, and event-monitor settings for Arista EOS.

GETVPN (Group Encrypted Transport VPN) — Cisco IOS/IOS-XE

Config · Cisco IOS

Group Encrypted Transport VPN for large enterprise MPLS networks. Preserves original IP headers (no encapsulation overhead), uses a centralized Key Server to distribute group keys to all Group Members.

DMVPN Spoke — Cisco IOS/IOS-XE

Config · Cisco IOS

Configure a DMVPN branch (spoke) router: mGRE tunnel, NHRP registration to the hub, and IPsec protection. Supports dynamic WAN IP, Phase 3 NHRP Shortcut for direct spoke-to-spoke tunnels, and EIGRP routing overlay.

DMVPN Hub — Cisco IOS/IOS-XE

Config · Cisco IOS

Configure the DMVPN Hub router: mGRE tunnel, NHRP server, IPsec with IKEv2 or IKEv1, and EIGRP routing overlay. Phase 3 NHRP Redirect included for spoke-to-spoke optimization.

Juniper JunOS SNMP v3 and Syslog

Config · Juniper

SNMPv3 with authentication and privacy, SNMP client lists for source restriction, structured syslog to remote collectors, and NTP - the monitoring baseline for any JunOS device.

Path MTU Analyzer

Script · Troubleshooting

A ping is 100 bytes and the query result is 9000, so every diagnostic anyone reaches for first is the wrong size to find the problem. This measures the largest packet a path actually passes -- DF-bit binary search, hop by hop -- and compares it against what the devices believe. The gap between the two is an encapsulation nobody told you about. It also detects the PMTUD black hole, where ICMP fragmentation-needed is filtered and TCP opens a session it cannot use.

Infoblox VLAN / Network Provisioner

Script · Automation

Provisions a new VLAN on an Infoblox NIOS grid as the five objects it really is -- the network, the DHCP range, the DHCP options, the reverse zone and the gateway records -- from one YAML template plus a list of VLANs, over WAPI v2.x. Creates them in topological order, because a range cannot exist before its network and a PTR cannot exist before its reverse zone, and reports what DID get created when a step fails. Refuses a DHCP pool that would hand out the gateway, computes the one reverse zone a /24 needs and the two a /23 needs, and detects the /25 case it cannot create at all because RFC 2317 delegation has to come from the parent. Dry run by default; writes only with --apply.

Infoblox Bulk DNS Record Creator

Script · Automation

Creates A, PTR, CNAME and host records on an Infoblox NIOS grid from a CSV, over WAPI v2.x. Dry run by default: it prints the whole plan with the count per operation before anything is written, validates the entire CSV offline so it cannot fail on row 3000 with 2999 records already created, refuses a plan over 500 objects unless confirmed, and writes a rollback file of every _ref it created.

PCAP Flow Summary

Script · Troubleshooting

Turns a packet capture into the short list of flows worth opening in Wireshark. Ranks conversations by severity and then by volume, and separates the findings an expert separates: a receiver advertising zero window (the application is not reading, the network is innocent) from retransmissions on the path, and a SYN that was never answered (look at the far end) from a SYN-ACK the client never completed (look at the client). Declares what the capture itself cannot prove - snaplen truncation, one-directional flows, flows that began before the capture did - instead of giving a verdict it has not earned. A field that could not be read prints as a dash, never as zero. Reads pcap and pcapng in either byte order, offline, stdlib only: the capture never leaves the machine.

Infoblox Stale DNS Record Finder

Script · Diagnostics

Finds DNS technical debt on an Infoblox NIOS grid over WAPI v2.x: A records with no PTR, orphaned PTRs, dangling CNAMEs and names nobody has queried in months. Keeps 'could not verify' in a separate list from the findings, because a host that ignores a probe is not a dead record. Read-only, never deletes, exports CSV, and replays offline from saved responses.

Return Path Verifier

Script · Troubleshooting

Every routing table you look at is the path OUT. Traffic has to come back, and nothing says it comes back the same way -- when it does not, a stateful firewall sees a SYN and never a SYN-ACK and drops a flow that routing says should work. This walks both directions, marks where they part company, and then reads two clocks at that point: how old the route is and how old the adjacency under it is. A route much younger than its adjacency means nothing failed -- somebody changed a policy.

Crypto-Agility

Skill · cybersecurity

Almost no system can change algorithm without a redesign -- which is what turns a migration into a multi-year programme instead of a config change

BGP Prefix Count Monitor & Leak Detector

Script · Monitoring

Tracks prefix counts per BGP peer and per VRF, learns a baseline automatically, and alerts on route leaks and mass withdrawals. The baseline deliberately refuses to absorb an anomalous sample — otherwise a leak becomes the new normal within a few polls and the alert stops firing, which is exactly when you need it. Distinguishes a session that is down from one advertising zero prefixes, writes baselines atomically so a crash cannot corrupt them, and supports per-device min/max thresholds. Full VRF awareness across all eight platforms.

Splunk for Security

Skill · cybersecurity

SPL that distributes -- tstats against accelerated data models, the summariesonly flag that returns nothing and succeeds, the stats rewrites for join and transaction, and CIM as the reason a search works in more than one company.

Log Timeline Builder

Script · Security

Merges logs from multiple sources into one timeline normalised to UTC. Reads syslog, Linux auth.log, Windows event exports, Apache/Nginx access logs, firewall logs, JSON lines and CSV, detecting the format from the content. Built around one rule: a timestamp with no timezone is never silently assumed to be UTC — it is marked UNZONED, reported in a warning block, and the script exits 1. Silently guessing produces a timeline that is internally consistent and wrong by hours, which is the most common error in incident log analysis. Per-source timezones, gap markers, regex filtering, time-range narrowing, and CSV/JSON export for the timeline table of an incident report. Stdlib only.

WAN & SD-WAN Designer

Agent · design

Designs multi-transport WANs by site tier, and challenges the diversity claim before anything else — two carriers is not two paths.

SD-WAN

Skill · networking

SD-WAN expert -- Cisco Catalyst SD-WAN (Viptela) and Fortinet SD-WAN, OMP, TLOCs, SLA policy, path selection

Pentest Reporter

Agent · security-review

Writes the report the engagement is judged on - and the one lawyers, insurers and acquirers will read. The coverage statement that distinguishes tested-and-clean from never-looked-at, severity against business risk, and the chain a scanner cannot see.

BGP Troubleshooting Assistant

Prompt · Troubleshooting

CCIE-level BGP diagnostic assistant. Paste your BGP output and describe the symptom — get a full diagnostic tree covering FSM states, path selection algorithm, route policy issues, and platform-specific commands for Cisco IOS/IOS-XE, IOS XR, NX-OS, Juniper JunOS, and Arista EOS.

Infoblox NIOS — DDI Fundamentals

Skill · networking

IPAM is a claim about reality that decays. The Grid Master outage that is a change freeze and not an outage, views that break a site while the config looks right, host records versus A plus PTR, and Extensible Attributes as the only reason IPAM means anything.

Prompt Engineer — Infrastructure

Agent · ai-automation

Rewrites prompts about networks, firewalls, cloud and systems so the answer can be checked against a real device — and tells you when the task should not be a prompt at all.

VXLAN VTEP & EVPN Fabric Monitor

Script · Monitoring

Monitors VXLAN fabric health across Cisco NX-OS, IOS-XE, Arista EOS and Juniper Junos. Beyond per-device VTEP, VNI and BGP EVPN state, it compares leaves against each other and reports the asymmetries no single device can see: a leaf that sees a peer which does not see it back, a VNI configured on three leaves and missing from a fourth, or a node with fewer tunnels than the rest of the fabric. Correctly reads the vPC anycast VTEP secondary address on NX-OS, so a healthy vPC pair is not reported as broken.

Subnet Forensic Scanner

Script · Security

Deep forensic subnet scanner for network security assessments. Performs ICMP host discovery, TCP scan across 1000 common ports, OS fingerprinting via TTL analysis, service banner grabbing (SSH/HTTP/FTP/SMTP), SMB signing check, RDP/Telnet detection, SNMP default community probing, TLS certificate inspection, and per-host risk scoring (HIGH/MEDIUM/LOW). Exports findings to JSON and CSV. For authorized testing only.

F5 BIG-IP Troubleshooting

Skill · networking

Isolates an F5 fault to the right object in the chain — virtual server, pool, monitor, profile, SNAT or iRule — instead of guessing at the config.

Check Point Drop Analyzer

Prompt · Troubleshooting

CCSE-level assistant for finding out why a Check Point gateway is dropping traffic on R82.x. Starts with fw ctl zdebug drop, rules out SecureXL acceleration before believing any capture, reads the four fw monitor inspection points, and separates Access Control from NAT, anti-spoofing, table limits, IPS and ClusterXL.

ACL / Policy Security Analyzer

Script · Security

Finds overly permissive and unreachable rules in ACLs and firewall policies across a mixed-vendor fleet. Checks whether each ACL is actually bound to an interface or VTY line, so a permissive rule that is live is rated HIGH while the same rule in an unused ACL is MEDIUM — the difference between an open door and latent risk. Also detects rules that can never match because an earlier rule already covers them, which is where stale permissions hide. Covers Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos filters, Arista EOS, FortiOS policies, and PAN-OS security rules.

BGP Neighbor State Monitor

Script · Monitoring

Tracks BGP session state, flaps and prefix counts per peer and per VRF across all eight platforms. Counts flaps over a rolling time window rather than a lifetime total, so a peer that flapped twice last year reads as healthy while twice in the last hour is flagged unstable. Distinguishes a peer that is down from one that has never come up since monitoring began, and a down session from one Established with zero prefixes. Persists history atomically, supports webhook and syslog alerting, and returns a non-zero exit code for cron.

Active Directory Security

Skill · cybersecurity

CISSP-level AD security expert — attack techniques, detection, hardening, and privileged access management

Firewall Policy Security Review

Prompt · Security

Senior firewall engineer / PCNSE / NSE-level security review. Analyzes your firewall ruleset for permit-any-any, shadow rules, missing logging, unused objects, NAT hairpin issues, zero-trust alignment, and compliance gaps. Platform-specific guidance for Palo Alto PAN-OS, Fortinet FortiOS, Cisco ASA, Cisco FTD, and iptables.

VPN Tunnel Troubleshooting Assistant

Prompt · Security

CCIE Security-level VPN diagnostic assistant. Covers DMVPN (Phase 1/2/3), FlexVPN, GETVPN, Site-to-Site IPsec IKEv1/v2, and AnyConnect. Diagnoses IKE Phase 1 failures, IKE Phase 2 failures, NHRP issues, GRE/mGRE problems, and data-plane routing issues across Cisco IOS/IOS-XE, ASA, FTD, Juniper SRX, Palo Alto, and Fortinet.

CVE Vulnerability Prioritization

Prompt · Security

Paste a list of CVEs or vulnerability scan results and get a prioritized remediation plan based on your network context, exploitability, and actual risk — not just CVSS score.

BGP Route & Path Selection Analyzer

Script · Troubleshooting

Explains which BGP path wins for a prefix and exactly which step of the decision process chose it. Walks all ten steps in order — weight, local-pref, AS-path length, origin, MED, eBGP over iBGP, IGP metric, router-id, neighbor address — and names the step that actually narrowed the field to one, rather than the first attribute that happened to differ. Queries several routers at once and reports when they disagree on the best exit, which is the answer to why traffic from one site takes a different path than another.

Interface Utilization Report

Script · Monitoring

Measures real interface throughput by sampling counters twice and computing the delta. Reads each interface's negotiated speed from the device so utilisation is a true percentage — a saturated 100M port is reported at 100%, not 10%. Detects 32-bit counter wraps and resets instead of silently reporting a bogus rate, and surfaces input/output errors and drops alongside the rate, because a link at 40% with rising errors is the real problem. All devices are sampled concurrently, so a fleet-wide run takes one interval, not one interval per device.

Kubernetes Manifest Writer

Agent · configuration

Writes the manifest the workload actually needs and names the clause you did not know you were signing - QoS class, CPU throttling, the liveness probe that takes the service down.

BGP EVPN / VXLAN Fabric Design Advisor

Prompt · Design

CCIE Data Center / SP architect for BGP EVPN VXLAN overlays. Covers underlay design (OSPF/IS-IS/eBGP), overlay (MP-BGP EVPN, RT/RD design, ARP suppression), VTEP design, multi-tenancy with VRFs, symmetric vs asymmetric IRB, anycast gateway, and multi-site DCI. Platform-specific guidance for Cisco NX-OS and Arista EOS.

Zero Trust Architecture Design

Prompt · Design

Expert guide to designing Zero Trust Network Architecture (ZTNA) based on NIST SP 800-207. Covers identity verification, device posture, micro-segmentation, application access control, and continuous monitoring. Platform guidance for Palo Alto Prisma Access, Fortinet ZTNA, Cisco Duo + Umbrella, Zscaler ZIA/ZPA, and Microsoft Entra.

Digital Forensics (DFIR)

Skill · cybersecurity

Findings that survive challenge: the pull-the-plug decision that destroys the encryption key, what a write blocker does not prove, $FILE_NAME versus $STANDARD_INFORMATION and how timestomping is caught, and why presence is not execution.

HAProxy Load Balancing

Skill · networking

Read the termination state, find the timeout that actually fired, and map an F5 LTM design onto frontend/backend without losing persistence

Packet Capture Root Cause Analysis

Prompt · Troubleshooting

Turn a capture into a root cause that another engineer can check. Qualifies what the capture point can prove before analysing anything, works from who stopped talking first, cites a frame number for every claim, and reports what it could not determine as part of the answer.

F5 Pool Member Drain

Script · Config Management

Disable an F5 pool member, wait for its connections to actually reach zero, and report when it is safe to touch the server. Never resets a connection unless you ask for it.

Infoblox Unused IP Space Finder

Script · Diagnostics

Walks every network, DHCP range and fixed address on an Infoblox NIOS grid over WAPI v2.x and sorts them into verifiably free, free with a caveat, and could-not-verify. Read-only, never deletes, exports CSV, and replays offline from saved responses.

VLAN Table Auditor

Script · Diagnostics

Pulls VLAN tables from a mixed-vendor fleet and reports what is inconsistent ACROSS switches — the same VLAN ID carrying two different names, a VLAN present on four of six switches, a gateway SVI in an unexpected place, or VLANs suspended on some members only. These are the conditions that cause intermittent, hard-to-trace failures. Also finds VLANs defined with no ports assigned. Exports the full table to CSV and returns a non-zero exit code when the domain is inconsistent.

Packet Capture Investigator

Agent · troubleshooting

Only concludes what a packet supports, and cites the frame

Host Vulnerability Scanner

Script · Security

Agentless vulnerability scanner that connects via SSH (Linux) to enumerate installed packages, OS/kernel version, and running services. Matches against a CVE database and checks CIS Benchmark controls: SSH hardening (PermitRootLogin, PasswordAuthentication, X11Forwarding), world-writable files, unexpected SUID binaries, and EOL OS detection. Produces risk-scored findings (CRITICAL/HIGH/MEDIUM/LOW) with patch remediation steps. Optionally queries the NVD API for live CVSS scores.

OSPF Troubleshooting

Skill · networking

CCIE-level OSPF fault isolation across IOS/IOS-XE, IOS XR, NX-OS, JunOS, Arista EOS, and FortiOS.

Pentest Scoping & Reporting

Skill · cybersecurity

Engagement governance expert -- authorization, scope definition, rules of engagement, risk rating, report writing, retest

BGP Troubleshooter

Agent · troubleshooting

CCIE-level BGP: isolates a fault to a layer, and designs the iBGP topology, convergence and policy architecture behind it.

Hardening Auditor

Agent · security-review

Audits against CIS, STIG and NIST by exposure rather than control number — including the IPv6 first-hop security almost nobody deploys.

Network Change Request Writer

Prompt · Configuration

Describe a network change and get a complete change request document: scope, risk assessment, rollback plan, step-by-step implementation, and verification commands.

TLS Configuration Review

Prompt · Security

Reviews the TLS configuration you paste — cipher suites, protocol versions, curves, OCSP stapling, HSTS, mTLS, session resumption and 0-RTT — against RFC 9325 (BCP 195), RFC 8446 and NIST SP 800-52r2. Starts from the defect that sinks most carefully hardened configurations: TLS 1.3 and TLS 1.2 select suites through different mechanisms, so a meticulous cipher list never touches 1.3. Covers hybrid post-quantum key exchange (X25519MLKEM768) as a setting available today, and always separates what it verified from what it could not see in the text.

VPN Architecture Design Advisor

Prompt · Design

CCIE Security architect-level VPN design advisor. Covers DMVPN Phase 1/2/3, FlexVPN, GETVPN, Site-to-Site IPsec, and SD-WAN with real trade-offs, scalability limits, crypto recommendations, and hub redundancy design. Tells you exactly which technology to use and why for your specific scenario.

F5 UCS Backup

Script · Config Management

Create a UCS archive on each BIG-IP and download it off the device, with retention. A UCS that only exists on the box it came from is not a backup.

FMC Unused Object Finder

Script · Security

Finds objects in Cisco Secure Firewall Management Center that no policy references, exports them to CSV, and cross-checks its answer against FMC's own unusedOnly filter. Exports what the GUI will not, covers the classes the native filter does not, and flags the dangerous case where FMC calls an object unused but a policy still references it.

FortiManager Unused Object Finder

Script · Security

Finds objects in FortiManager ADOMs that no policy references and exports them to CSV. Resolves every reference against the ADOM that made it and against global, walks policy packages inside folders, and refuses to call a global object unused unless every ADOM was analysed.

Post-Quantum Cryptography Fundamentals

Skill · cybersecurity

PQC is classical maths, not QKD -- key exchange migrates first because signatures cannot be broken retroactively

Change Request Writer

Agent · operations

Turns a technical intent into a CAB-ready change request with a real rollback plan, a stated blast radius and verification steps.

F5 Certificate Expiry Audit

Script · Config Management

Which certificates expire when, and exactly what breaks: the chain from certificate to client-SSL profile to virtual server, sorted by urgency. Read-only.

IPv6 Security Audit

Script · Security

Finds the IPv6 holes in a device configuration: the interface filtered on IPv4 and open on IPv6, access ports without RA Guard, the RA Guard that is bypassable because nothing drops ND fragments, ACLs that break ICMPv6, and the /64 on a point-to-point link. Read-only, multi-vendor, and runs against saved configs with no device access.

Firewall Policy Auditor

Agent · security-review

Audits the MERGED effective rulebase — pre-rules included — plus decryption, identity and inspection, not just the security rules.

Post-Quantum Risk Assessment

Prompt · Security

Assesses a system's exposure to post-quantum cryptographic risk using Mosca's inequality — confidentiality lifetime plus migration time against the arrival of a cryptographically relevant quantum computer. Separates key exchange (vulnerable to harvest now, decrypt later) from signatures (which are not), demands evidence of library, version and protocol before concluding, and targets hybrid key exchange rather than pure PQC because hybrid is what actually deploys today.

F5 iRule Linter

Script · Security

Static analysis for F5 iRules. Reads a .tcl file and flags the things that are invisible in the editor: a missing HTTP::release that hangs connections, shared state that demotes the virtual server out of CMP with no error logged, commands used in an event where they are not available, and regex or logging on the data path.

Panorama Unused Object Finder

Script · Security

Finds network objects in Palo Alto Panorama that no policy references and exports them to CSV, honouring device-group inheritance, nested groups and overrides. Separates verified unused from transitively dead from could-not-verify, never deletes anything, and states in every report which reference classes it did not read.

Network Monitoring & Observability

Skill · networking

Observability expert -- SNMP vs streaming telemetry, flow analysis, Prometheus/Grafana, SLI/SLO, alert design

PQC Readiness Assessor

Agent · security-review

Assesses whether an estate is ready to migrate to post-quantum cryptography — lifetime first, key exchange before signatures, and NOT DETERMINED where it cannot verify.

OSPF Troubleshooting Assistant

Prompt · Troubleshooting

Paste your OSPF show output and get a diagnosis of neighbor issues, adjacency failures, and routing problems. Works with Cisco IOS, NX-OS, Juniper, and Arista.

SIEM Query Translator & Builder

Prompt · Security

Describe what you want to find in plain English, or paste a query from one SIEM, and get the working equivalent in Splunk SPL, Microsoft Sentinel KQL, Elastic ES|QL/KQL, QRadar AQL or Chronicle UDM — with the field-mapping differences and the performance traps named rather than silently glossed over.

Network Technology Explainer

Prompt · Learning

Get a clear, level-appropriate explanation of any networking or security technology — from basic to expert. Great for learning a new protocol, preparing for a cert exam, or explaining something to your team.

Network Device Config Backup

Script · Config Management

Connects to every device in your inventory, downloads its running configuration, and saves each to a timestamped file. Rejects truncated output that would look like a valid backup but could not restore a device, strips volatile lines so unchanged configs produce identical files, and can skip writing when nothing changed. Devices come from a devices.yaml inventory; credentials from environment variables, never the file. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.

Database Schema Design

Skill · databases

Relational modelling as a set of trade-offs: keys and UUID locality, constraints, the data types people get wrong, soft deletes, JSONB versus columns, multi-tenancy

PostgreSQL Performance

Skill · databases

Instance-level PostgreSQL: memory that is not what its name suggests, pooling, autovacuum and wraparound, WAL and checkpoints, slots, and lock queues

IPv6 Connectivity Troubleshooter

Prompt · Troubleshooting

IPv6 diagnostic assistant that starts where the fault actually divides: SLAAC, DHCPv6 or static. Covers Router Advertisement flags, Neighbor Discovery, source address selection per RFC 6724, the default route that arrives in an RA, and the ICMPv6 filtering that breaks IPv6 outright instead of degrading it. Cisco IOS/IOS-XE, IOS XR, NX-OS, Juniper JunOS, Arista EOS, Palo Alto PAN-OS and Fortinet FortiOS.

Zero Trust Architecture

Skill · cybersecurity

NIST SP 800-207 expert -- policy engine design, microsegmentation, identity-centric access, ZTNA migration

SQL Optimizer

Agent · troubleshooting

Reads the execution plan before the query - finds the estimate gap, designs the index, and says what the fix costs

VPN Troubleshooter

Agent · troubleshooting

CCIE Security level IPsec: works a fault phase by phase, and chooses the overlay, DMVPN phase and routing protocol behind it.

Log Triage Analyst

Prompt · Security

Paste raw logs — syslog, Windows events, firewall, proxy, auth, cloud audit — and get a structured triage: what the events actually say, a UTC timeline, the benign explanation checked before the malicious one, and the specific next query. Built to say "this is normal" when it is.

Sigma Detection Rule Builder

Prompt · Security

Turn an attacker technique, an IOC, or a description of suspicious behaviour into a valid Sigma rule with correct logsource, realistic field names, a false-positive section and a tuning plan. Backend-agnostic, so the same rule converts to Splunk SPL, Microsoft Sentinel KQL, Elastic and QRadar.

BGP Community Tagger

Script · Config Management

Generates BGP community tagging policy for IOS/IOS-XE, IOS-XR, NX-OS, Arista EOS and Junos from one set of prefix rules, and optionally pushes it with verification and automatic rollback. Gives each rule its own prefix-list so communities are not cross-applied, emits the trailing permit that stops a route-map silently dropping every unmatched prefix, and validates every prefix and community string before generating anything. Dry-run by default; pushes use commit-confirmed on IOS-XR and Junos.

F5 iRule Writer

Agent · configuration

Writes iRules, and starts by trying to talk you out of needing one. Names the profile or LTM policy that does it compiled, and when TCL really is required, writes it with the per-request cost and the verification stated.

Pre-Flight Config Validator

Script · Config Management

Catches bad configuration before it reaches production. Three layers: offline static analysis (dangerous commands, invalid IP/mask, subnet overlaps, forward references, orphaned sub-commands, per-OS syntax shape), semantic checks against live device state (unknown interfaces, port-channel members, existing VLANs), and device-side validation using each platform's own parser without committing — JunOS commit check, EOS session diffs, IOS-XR show configuration failed. Exit codes suit CI gating.

Multi-Device SSH Command Runner

Script · Automation

Runs a read-only show command across your whole fleet at once and collects the output. Read-only by design: any command that could enter config mode or change state is refused before a single session opens. Supports a different command per OS in the same job, VRF-scoped queries, regex filtering of the output, and saving everything to files. Devices come from a devices.yaml inventory; credentials from environment variables, never the file. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.

VPN Tunnel Monitor

Script · Monitoring

Monitors IPsec/IKE tunnel state across Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Palo Alto PAN-OS and Fortinet FortiOS. Reads encap and decap counters, not just tunnel state, so it catches the failure a state check calls healthy: a tunnel that is UP with packets going out and none coming back. Also warns on SAs about to rekey and reports an expected peer that has no SA at all, which is different from a peer whose tunnel is down.

Post-Quantum Migration Engineering

Skill · cybersecurity

The parts of a PQC migration that hurt -- the inventory you cannot finish, the chain that no longer fits, and the rollback nobody wrote

DMVPN Health Check

Script · Troubleshooting

Checks all three DMVPN layers and tells you which one broke. GRE tunnel state, NHRP registration and resolution, and the IPsec crypto session fail independently and need completely different fixes, so every finding is tagged with its layer and carries the specific remediation. Reads the DMVPN session state directly — UP, NHRP or IKE — which names the failing layer without inference, and checks encap/decap counters to catch tunnels that are up but passing traffic one way only.

IOC Extractor

Script · Security

Pulls indicators of compromise out of unstructured text: logs, emails, threat advisories, incident notes or pasted output. Extracts IPv4/IPv6, domains, URLs, email addresses, MD5/SHA1/SHA256 hashes, CVEs, Bitcoin addresses, Windows file paths and registry keys. Refangs defanged notation on the way in (evil[.]com, hxxp://, user[at]domain) and defangs on the way out so results are safe to paste into a ticket. Filters the noise that makes raw regex extraction unusable: private and documentation IP ranges, filenames that look like domains, and the vendor domains present in every corporate log. Groups domains by registrable name to surface DGA-style subdomain sprawl. Stdlib only, no dependencies.

Web Application Security Scanner

Script · Security

OWASP Top 10 automated scanner for web applications. Detects SQLi, reflected XSS, directory traversal, open redirects, sensitive file exposure (.env, .git, backups), missing security headers (HSTS/CSP/X-Frame), insecure cookie flags, server version CVEs, and CORS misconfigurations. Produces risk-scored findings with remediation steps. For authorized testing only.

Check Point Expert

Agent · operations

Check Point generalist on R82.x and the Management API. Asks for the release before giving a command, starts every drop at fw ctl zdebug drop, and refuses to believe an empty fw monitor until SecureXL acceleration has been ruled out.

Config Reviewer

Agent · configuration

Reviews a pasted device configuration for risk, deviation and omission, and ranks findings by blast radius rather than by line number.

F5 iRule Analyzer

Agent · configuration

Audits an existing iRule and measures instead of guessing: timing on and per-event cycle counts, the execution order across every rule on the virtual server, the missing release that hangs connections, and shared state that demotes CMP with nothing logged.

MCP Server Builder

Agent · ai-automation

Designs and builds MCP servers that expose infrastructure to AI assistants, with the blast radius and the context budget designed in rather than discovered.

OSPF Troubleshooter

Agent · troubleshooting

CCIE-level OSPF: isolates an adjacency fault by its stuck state, and designs areas by database size and SPF cost rather than router count.

ACL / Firewall Policy Security Review

Prompt · Security

Paste your ACL, firewall policy, or security filter and get a security analysis: permit-any rules, missing explicit deny, shadow entries, and optimization suggestions. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.

Network Device Error Explainer

Prompt · Troubleshooting

Paste any syslog message or error output from your network device and get a plain-English explanation, severity assessment, root cause, and remediation steps. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.

Cloud Security Posture

Skill · cybersecurity

CISSP-level cloud security expert — AWS/Azure/GCP IAM hardening, network security, CSPM, logging, and compliance frameworks (CIS, NIST, SOC2, PCI-DSS)

F5 BIG-IP Expert

Agent · operations

Triage first: the site is down can be eight different faults across LTM, DNS, ASM, APM or TMOS. Carries the packet's journey as a mental model and volunteers the facts that live between modules and nobody owns.

F5 iRule Troubleshooter

Agent · troubleshooting

The iRule is deployed and behaving wrongly. Works from the symptom and from the box: TCL errors read precisely, the abort count nobody looks at, rule-profiler for the real event order, and the four things that change behaviour without appearing in the code.

Incident Responder

Agent · blue-team

Works to NIST SP 800-61r3 and the CSF 2.0 Functions, with ransomware and BEC playbooks and the identity containment that a password reset does not achieve.

MikroTik RouterOS Expert

Agent · operations

Fixes the RouterOS version and the board model before answering anything, because v7 rewrote the routing stack and the board decides whether the switch chip offloads.

Schema Migration Planner

Agent · operations

Sequences a schema change across deploys so old and new application code both run - locks, backfills, and what cannot be rolled back

DMVPN / FlexVPN / GETVPN Design Advisor

Prompt · Design

CCIE Security design advisor for enterprise VPN architectures. Compares DMVPN Phase 1/2/3, FlexVPN (IKEv2), and GETVPN across scenarios: branch connectivity, MPLS overlay, spoke-to-spoke optimization, and dual-hub redundancy. Gives you an opinionated recommendation with routing, crypto, QoS, and scalability guidance.

Running vs Startup Config Diff

Script · Config Management

Finds configuration that is running but was never saved — changes that silently disappear on the next reload. Also compares against the newest file from config-backup to detect drift since that backup. Strips timestamps and other volatile lines so the diff shows real change only. Correctly reports that IOS-XR, Junos and FortiOS have no unsaved state rather than producing a meaningless diff. Returns a non-zero exit code so it works as a cron or CI check.

Sigma Rule Validator

Script · Security

Validates Sigma detection rules offline and catches the defects that make a rule silently dead: a condition referencing a selection that does not exist, a mistyped logsource category, a field name with the wrong case, an invalid modifier. Each of those converts cleanly to SPL or KQL and then matches nothing forever — no tool errors, no alert fires, and the coverage matrix still shows green. Also flags quality problems a syntax checker passes: exclusions built on a bare path an attacker can write to, falsepositives left as Unknown, unused selection blocks, aggregations with no timeframe, and duplicate UUIDs across a library. Findings are split ERROR / WARNING / INFO and exit 2 on an error, so it can gate a detection-as-code pipeline.

DMVPN / FlexVPN / GETVPN

Skill · networking

CCIE-level expert for Cisco DMVPN Phase 1/2/3, FlexVPN (IKEv2), and GETVPN (GDOI) — hub/spoke design, spoke-to-spoke tunnels, troubleshooting

Detection Engineer

Agent · blue-team

Writes Sigma, YARA and Suricata rules that key on an invariant rather than a tool name, and measures the noise before anything is deployed.

Network Device Hardening Review

Prompt · Security

CCIE Security / CIS Benchmark expert-level hardening review. Analyzes your device configuration across management plane (SSH, AAA, TACACS+), control plane (CoPP, BFD), and data plane (uRPF, DHCP snooping, DAI). Covers Cisco IOS/IOS-XE/IOS-XR/NX-OS, Palo Alto PAN-OS, Fortinet FortiOS, Juniper Junos, and Arista EOS against CIS benchmarks, NIST 800-53, PCI-DSS, and ISO 27001.

Config Compliance & Golden-Config Drift Checker

Script · Security

Audits running configuration against a declarative policy and reports what is non-compliant, why it matters, and the exact remediation. Ships with 38 CIS-aligned rules across all eight platforms covering AAA, management plane, insecure services, SNMP, logging, NTP, and routing protocol authentication. Also diffs against per-role golden templates to catch drift. Generates ready-to-push remediation fragments that feed straight into config-validator and config-rollback.

NHRP Cache Inspector

Script · Troubleshooting

Inspects the NHRP cache on DMVPN hubs and spokes and explains what each failure means. Detects INCOMPLETE entries (resolution requested and never answered), spokes that never registered, NHS unreachable from a spoke, and the signature of broken spoke-to-spoke tunnels — resolution requests sent with zero replies received. Cross-checks each hub's view against the spokes that actually answered, so a spoke that thinks it registered but does not appear in any hub cache is reported directly.

Database Security

Skill · databases

The layer that decides how much a breach costs: pg_hba first-match, the PUBLIC grant, SECURITY DEFINER hijacking, RLS and its three bypasses, and why sslmode=require verifies nothing.

Kubernetes Troubleshooter

Agent · troubleshooting

Isolates a Kubernetes fault to its layer - scheduling, image, resources, probes, storage or control plane - and names the self-inflicted ones

Safe Config Push with Automatic Rollback

Script · Config Management

Push configuration with a guaranteed way back. Uses each platform's native rollback mechanism — IOS-XR and JunOS commit confirmed, EOS commit timer, NX-OS checkpoints, IOS-XE configure replace, FortiOS revisions — so the device self-reverts if the script dies mid-change. Runs pre/post assertions and rolls back automatically when a check fails. Dry-run by default. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper JunOS, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.

DNS Security Analyzer

Script · Security

Comprehensive DNS security analysis covering: zone transfer testing (AXFR — if successful, attacker gets complete DNS map of your network), DNSSEC validation, SPF/DKIM/DMARC email authentication records, CAA record checks, detection of DNS tunneling patterns in query logs (high-entropy subdomains, TXT record exfiltration), subdomain enumeration via certificate transparency logs, wildcard DNS detection, and dangling DNS records pointing to decommissioned cloud resources (subdomain takeover risk). Also tests whether nameservers act as open resolvers that can be abused for DDoS amplification.

VPN Crypto Audit

Script · Security

Audits IPsec/IKE cryptographic configuration against NIST SP 800-131A and RFC 8247 across Cisco IOS/IOS-XE/IOS-XR, Juniper Junos, Palo Alto PAN-OS and Fortinet FortiOS. Flags DES/3DES/RC4/NULL encryption, MD5 and SHA-1 integrity, DH groups 1/2/5/22/23/24, IKEv1, and missing Perfect Forward Secrecy — each with the reason it is weak and the specific fix. Devices it cannot parse, or whose commands returned nothing, are reported as UNAUDITED rather than clean: an audit that silently passes a device it never inspected is worse than no audit.

Network Architect

Agent · design

Designs enterprise and campus networks from requirements, and states the trade-off behind every decision instead of hiding it.

Runbook to Agent

Agent · ai-automation

Converts an operational runbook into an AGENT.md, classifying every step by risk — and reporting the runbook's gaps before converting anything.

Phishing Email Analyzer

Script · Security

Forensic analysis of suspicious emails (.eml / .msg files). Parses email headers to trace the true origin (Received headers chain), validates SPF, DKIM, and DMARC authentication records, extracts and checks URLs against threat intelligence (VirusTotal, URLhaus), analyzes attachments (SHA256 hash, file type detection, macro/OLE detection in Office files), detects display name spoofing and lookalike domains, and generates a full threat report. Essential for SOC tier-1 triage and incident response.

Container & Kubernetes Security Scanner

Script · Security

Security audit for Docker images and Kubernetes clusters. For Docker: scans image layers for CVEs via Trivy subprocess, detects secrets baked into image layers (AWS keys, private keys, passwords), identifies containers running as root or with privileged flags, and validates Dockerfile best practices. For Kubernetes: audits RBAC (ServiceAccounts with cluster-admin, wildcard verbs, Secrets access), PodSecurityContext misconfigurations, containers without resource limits, privileged pods, hostPath mounts to Docker socket, missing NetworkPolicies, and externally-exposed services including the Kubernetes Dashboard.

GETVPN Key Server Monitor

Script · Monitoring

Monitors GETVPN key servers and group members, and detects the failure mode that gives no warning: when every key server stops serving, the group members keep encrypting on the TEK they already hold, every tunnel looks healthy, and then the TEK expires and the entire group drops at the same instant. Correlates KS and GM state to catch that precursor, flags members the key server does not list, and reports TEK lifetime spread across the group — the signal that rekey is not reaching everyone.

Kubernetes Networking

Skill · networking

K8s networking expert -- Services and EndpointSlices, CoreDNS and ndots, kube-proxy modes, CNI differences, MTU, Ingress and Gateway API

Threat Hunting

Skill · cybersecurity

Hypothesis-driven hunting that produces a result either way — a finding, a detection, or a documented absence worth trusting.

ACL Auditor

Agent · security-review

Computes what every ACL line really matches — IPv4 and IPv6 — and accounts for the TCAM it compiles into and the CPU its logging costs.

Threat Intelligence Lookup

Script · Security

Multi-source threat intelligence lookup for IPs, domains, file hashes (MD5/SHA1/SHA256), and URLs. Queries VirusTotal v3, AbuseIPDB v2, MalwareBazaar, and ip-api.com geolocation. Checks Tor exit node status. Produces per-IOC verdict (MALICIOUS/SUSPICIOUS/CLEAN/UNKNOWN) with remediation actions. Ideal for SOC analysts and incident response.

Detection as Code

Skill · cybersecurity

A rule edited in a console has no author, no reason, no review and no way back. The pipeline from lint to verified-deployed, the false-positive test nobody can run because they have no benign corpus, and exceptions with expiry dates.

F5 iRules Patterns

Skill · networking

Event-driven TCL on the data path: the event order that decides what exists when, CMP demotion with no error message, the missing HTTP::release that hangs the connection, and the first question - should this be an LTM policy?

Active Directory Security Auditor

Script · Security

Connects to Active Directory via LDAP and audits for the most critical security misconfigurations: Kerberoastable service accounts (SPNs with user accounts), AS-REP Roastable accounts (no pre-auth), stale/inactive accounts with elevated privileges, users with Password Never Expires, AdminSDHolder misconfigurations, privileged group membership (Domain Admins, Enterprise Admins), accounts with reversible password encryption, and dangerous ACLs (GenericAll/WriteDACL on high-value objects). For authorized security assessments only.

Bulk Route Injection with Blast-Radius Guards

Script · Automation

Injects or withdraws static routes, BGP network statements, and redistribution across many routers with the guards that stop a routing change becoming an outage. Refuses default routes and over-broad prefixes, detects martians, analyses overlap against the live routing table to show what each route would shadow, verifies next-hop reachability so a route cannot silently black-hole, caps how many routes one run may add, and captures BGP peer count before and after — automatically reverting the whole change if a session drops. Full VRF awareness on every platform.

F5 BIG-IP DNS / GTM

Skill · networking

GSLB is DNS with a cache in front of it. The TTL that bounds every failover, the fallback method that ignores availability, topology scored by longest match, and the fact that GTM sees the resolver and never the client.

Kubernetes Security

Skill · cybersecurity

K8s security expert -- RBAC, Pod Security Standards, NetworkPolicy, secrets, supply chain, runtime detection

MPLS L3VPN

Skill · networking

Service provider MPLS expert -- LDP, RD/RT, VPNv4, PE-CE routing, label stack troubleshooting

Network Automation with Python

Skill · networking

Python network automation expert -- Netmiko, NAPALM, Nornir, pyATS, REST APIs, idempotent change workflows

Penetration Testing Methodology Guide

Prompt · Security

Senior penetration tester (OSCP/CEH/CPTS) methodology guide for authorized assessments. Structured across 7 phases: reconnaissance, scanning, vulnerability assessment, exploitation, post-exploitation, lateral movement, and reporting. For authorized engagements only.

Bulk VLAN Deployment with Consistency Verification

Script · Automation

Deploys VLANs across a switching domain and proves the result is consistent. Audits the current VLAN database and trunk allowed-lists first, reports name mismatches and partial presence before changing anything, then creates VLANs with optional SVIs and HSRP/VRRP/anycast gateways. Extends trunk allowed-lists using 'add' so the existing list is never replaced — the mistake that makes a VLAN exist everywhere and work nowhere. Re-audits afterward and fails loudly if the domain is still inconsistent.

Lateral Movement Detector

Script · Security

Analyzes Windows Security Event Logs (EVTX) and Linux auth logs to detect lateral movement patterns: Pass-the-Hash (NTLM Type 3 rapid multi-host logons), Pass-the-Ticket, RDP hopping chains, SMB/auth spraying, admin share access (C$, ADMIN$, IPC$), and new service installation as persistence. Builds authentication graphs and maps attacker movement across hosts. Critical for incident response and threat hunting.

OSPF Neighbor State Checker

Script · Monitoring

Checks OSPF adjacencies across your fleet and explains what each stuck state means. Detects neighbors in EXSTART, EXCHANGE, INIT and other faulty states, and — by declaring expected_neighbors per device — also detects adjacencies that disappeared entirely, which a state check alone cannot see. Accepts 2WAY as normal between DR-OTHER routers unless you ask otherwise. VRF-aware on IOS-XR, NX-OS, EOS and Junos. Returns a non-zero exit code so it works as a cron or monitoring check.

Log Analysis and Correlation

Skill · cybersecurity

A log records what something chose to write. The three timestamps a SIEM conflates, entity resolution as the actual work, parsers that fail silently and stop detections with no error, and correlation by absence.

SOC Analyst Workflow

Skill · cybersecurity

A SOC's product is decisions, not closed alerts. The four dispositions and why calling an authorised admin action a false positive quietly tunes away working detections, triage as a time-boxed decision, and the metrics that make analysts close alerts instead of understanding them.

Cloud Security Posture Auditor

Script · Security

Multi-cloud security posture assessment for AWS, Azure, and GCP. Checks for the most critical cloud misconfigurations: public S3/Blob/GCS buckets, overpermissive IAM roles (admin everywhere), MFA not enforced, CloudTrail/logging disabled, security groups allowing 0.0.0.0/0 on sensitive ports, unencrypted EBS/RDS volumes, publicly exposed databases, unused access keys older than 90 days, root account usage, and publicly exposed cloud functions. Maps findings to CIS Cloud Benchmark and AWS/Azure/GCP security best practices.

Palo Alto NGFW

Skill · cybersecurity

PAN-OS expert -- App-ID, Content-ID, security policy order, NAT, test commands, HA, Panorama

AIOps Advisor

Agent · ai-automation

Anomaly detection, alert correlation and capacity forecasting on infrastructure telemetry — starting with whether you have a data problem instead of a model problem.

Datacenter Fabric Designer

Agent · design

Sizes and designs a Clos fabric with the numbers: oversubscription, BUM replication cost per VTEP, ARP suppression and the silent host it breaks, breakout port math, where inspection attaches and the hairpin it creates, and what the next 50% of growth costs.

BGP Troubleshooting

Skill · networking

CCIE-level BGP diagnostic expert -- neighbor failures, missing routes, path selection, flapping

AI Agent Designer

Agent · ai-automation

Designs agentic systems for infrastructure — and will tell you when the thing you want is a script, which it usually is.

Network Incident Response Playbook

Prompt · Security

NIST IR framework-based incident response playbook tailored to your incident type and environment. Covers ransomware, data breach, DDoS, insider threat, phishing, and malware with phase-specific actions: detection, containment, eradication, recovery, and lessons learned. Includes forensic commands, chain of custody, legal notification timelines, and regulatory compliance (GDPR 72-hour rule, PCI-DSS).

F5 LTM Fundamentals

Skill · networking

The data path as a chain: most-specific virtual server match, the full proxy, SNAT and the return path that kills connections, monitors that only prove the port is open, and persistence that silently does nothing.

F5 ASM / Advanced WAF Tuning

Skill · cybersecurity

A WAF is almost never defeated, it is switched off. Policies that learned from attackers, signature staging expiring into an outage, and accepting suggestions until the policy means nothing.

Malware Analysis for Defenders

Skill · cybersecurity

Triage, not research: why uploading to a public scanner can tell the attacker you found them, a lab that does not announce itself, entropy and imports as the packing tell, and ranking indicators by how long they keep working.

Memory Forensics

Skill · cybersecurity

A memory image is a photograph of a moving object. Page smear, symbol tables as the real Linux blocker, pslist against psscan, malfind's false positives on JIT runtimes, and what memory can never tell you.

Datacenter BGP EVPN / VXLAN

Skill · networking

CCIE DC expert -- spine-leaf fabric, EVPN route types 1-5, VTEP troubleshooting, anycast gateway, multi-tenancy

F5 TMOS Administration

Skill · networking

The platform under the virtual servers: port lockdown that blocks HA, the sync direction that overwrites the wrong unit, traffic groups as the real unit of failover, and what a UCS cannot restore.

Fortinet FortiGate NGFW

Skill · cybersecurity

FortiOS expert -- diagnose debug flow, policy lookup, VDOMs, SD-WAN rule precedence, UTM profiles, FGCP HA

SOAR Playbook Design

Skill · cybersecurity

SOAR rarely fails because the automation breaks, it fails because nobody trusts it. The automation ladder, the half-run playbook, the alert storm where your own automation becomes the incident, and approvals that are decisions.

IKE SA Analyzer

Script · Security

Deep inspection of IKE Phase 1 and Phase 2 security associations across Cisco IOS/IOS-XE/IOS-XR, Juniper Junos, Palo Alto PAN-OS and Fortinet FortiOS. Flags deprecated DH groups and weak ciphers against RFC 8247, SAs that are READY but passing traffic one way only, and — when both ends of a tunnel are in the inventory — compares them against each other to find proposal asymmetry and duplicate SAs, the classic cause of a tunnel that works intermittently while both devices report themselves healthy.

Secrets & Credential Scanner

Script · Security

Scans source code repositories, configuration files, and directory trees for accidentally exposed secrets: API keys, passwords, tokens, private keys, AWS credentials, database connection strings, and JWT secrets. Checks git commit history (not just current files). Supports 50+ secret patterns including AWS, GCP, Azure, GitHub, Stripe, Slack, Twilio, SendGrid, and more. Essential for pre-commit CI/CD security gates and periodic audits.

SSL/TLS Certificate Checker

Script · Security

Checks TLS certificate expiry, trust, hostname match and crypto strength across any number of hosts. Fetches the certificate without verification first, so it reports the expiry date even when the certificate is expired or untrusted - and distinguishes expired from self-signed, untrusted CA and hostname mismatch instead of collapsing them into one error.

F5 APM Access Policies

Skill · cybersecurity

An access policy is a state machine that runs once per session, not a rule list. Editing it does not affect anyone logged in, AD Query without AD Auth checks no password, and the licence is concurrent sessions.

Bulk Interface Configuration

Script · Automation

Applies an interface profile to many ports across many switches with blast-radius control. Discovers live interface state, selects ports by name, description, VLAN or operational status, and automatically excludes trunks, port-channel members and uplink-named ports unless you opt in. Refuses to run when the selection exceeds a configurable cap, writes a per-device undo fragment reconstructed from the prior config, and verifies every port reached the intended state before saving.

Cisco ASA Firewall

Skill · cybersecurity

ASA/FTD expert -- packet-tracer diagnosis, NAT order of operations, ACL troubleshooting, AnyConnect, failover

Incident Response

Skill · cybersecurity

NIST SP 800-61r3 -- Revision 2 was withdrawn and the four-phase lifecycle with it. Triage, the containment decision, evidence handling, scoping, eradication criteria, and why your playbook still works.

BGP EVPN / VXLAN — Cisco IOS-XE (Catalyst 9000)

Config · Cisco IOS

Generate a VXLAN BGP EVPN configuration for Cisco Catalyst 9300/9500 (IOS-XE 16.11+). Supports symmetric IRB, distributed anycast gateway, ingress replication, and per-tenant VRF routing. Designed for campus DC pods and branch aggregation.

BGP Advanced Configuration — Cisco NX-OS

Config · Cisco NX-OS

Generate advanced BGP configurations for Cisco NX-OS (Nexus) using peer templates (session + policy), ECMP, BFD, and data center BGP best practices.

Cisco IOS XR Security Hardening

Config · Cisco IOS XR

Security hardening baseline for Cisco IOS XR routers (ASR 9000, NCS 5500). Covers AAA, SSH hardening, control-plane protection, management ACLs, and logging.

Cisco IOS XR MPLS L3VPN (PE Router)

Config · Cisco IOS XR

Full MPLS L3VPN PE configuration for IOS XR: VRF definitions, LDP, MP-BGP VPNv4, and CE peering. The flagship SP service on ASR 9000 and NCS 5500.

Cisco IOS XR OSPF Configuration

Config · Cisco IOS XR

OSPF configuration for Cisco IOS XR routers. Interface-based (no network command), supports BFD, multi-area, redistribution, and point-to-point links for SP environments.

Palo Alto PAN-OS SNMP v3 and Syslog

Config · Palo Alto

SNMPv3 with an authentication/privacy user, syslog server profiles, log forwarding profiles attached to security rules, and NTP - including the detail that traffic logs only forward when a rule references the profile.

Fortinet FortiOS SNMP v3 and Syslog

Config · Fortinet

SNMPv3 with host restriction, per-interface SNMP access control, syslog to multiple collectors with severity filtering, and NTP - configured per VDOM where VDOMs are enabled.

Network Config Redactor

Script · Security

Masks passwords, keys, SNMP communities, PSKs and tokens in network configs and logs, and remaps addresses consistently so the topology stays readable. Offline, standard library only, with a verify pass that re-reads its own output looking for what it missed.

Crypto Policy Checker

Script · Security

Checks TLS, SSH, X.509 certificates and IPsec against a cryptographic policy you write yourself in a declarative YAML file - allowed and forbidden algorithms, minimum key sizes, acceptable curves, protocol versions and certificate lifetime. Nothing is built in, so the tool enforces YOUR standard rather than someone else's. TLS and SSH are probed from outside with no credentials; IPsec is read from a managed YAML inventory over SSH. A check it could not determine is reported as UNVERIFIED with the reason, never as a pass and never as a finding - because "I could not tell" and "I verified this is wrong" are different facts. For fixed NIST SP 800-131A / RFC 8247 IPsec rules, use vpn-crypto-audit instead.

Detection Engineering

Skill · cybersecurity

Write Sigma, YARA and Suricata rules that survive contact with production — tuned, validated, and honest about what they do not cover.

IPv6 Enterprise Operations

Skill · networking

Ask where the address came from before anything else

KQL for Microsoft Sentinel

Skill · cybersecurity

KQL where operator order is the cost model -- has against contains and the term index, the join kind=innerunique that deduplicates the left side without saying so, ASIM and what normalisation costs, and the rule window shorter than the rule frequency that leaves a gap nothing evaluates.

Network AAA & Command Authorization

Skill · networking

Designing command authorisation profiles that work -- and why `permit show *` leaves a tool blind exactly where it matters

Packet Capture Analysis

Skill · networking

Start from who stopped talking first, not from the protocol tree

Crypto Inventory Agent

Agent · security-review

Finds and classifies the cryptography declared in the files you supply — algorithms, certificates, libraries, key sizes, TLS/SSH/IPsec settings — and says plainly what a text inventory cannot see.

Subnet Calculator

Tool · Network

IPv4 and IPv6 subnetting — host range, subnet-router anycast, /64 count, canonical form

DNS & Network SuperTool

Tool · Network

DNS records, SPF, DMARC, DKIM, WHOIS, HTTP headers, ASN, blacklist check and more

WHOIS Lookup

Tool · Network

Domain and IP registration data over RDAP, any TLD that publishes a service

IP Geolocation

Tool · Network

Country, city, ISP, ASN, coordinates, timezone — includes your own IP

Port Scanner

Tool · Network

TCP connect scan — check open ports on any host with presets or custom lists

Ping

Tool · Network

Test host reachability and round-trip latency with 4 probes

MAC Address Lookup

Tool · Network

Identify network device manufacturer from any MAC address via OUI database

SSL Checker

Tool · Security

Certificate details, expiry date, issuer, and chain validity for any domain

HTTP Headers

Tool · Security

Inspect response headers and security settings for any URL

Password Generator

Tool · Security

Cryptographically secure passwords with configurable length and character sets

Hash Generator

Tool · Security

SHA-1, SHA-256, SHA-384, SHA-512 hash of any text input

Email Header Analyzer

Tool · Security

Delivery path, SPF/DKIM/DMARC and whether they align with the From

JWT Decoder

Tool · Security

Decode and inspect JSON Web Token header, payload, and signature

CVE Lookup

Tool · Security

Search and read CVE details from the NVD vulnerability database

IP Reputation

Tool · Security

Abuse score, proxy/Tor/hosting detection flags for any IP

Sigma Rule Builder

Tool · Security

Build a Sigma detection rule and catch what converts cleanly and never matches

YARA Rule Tester

Tool · Security

Parse a YARA rule, test its strings against a sample, and catch the modifier traps

Log Parser

Tool · Security

Normalise syslog, CEF, LEEF, JSON, CSV, Apache or Cisco IOS log to columns — and name every assumption

PQC Size Impact Calculator

Tool · Security

How many bytes ML-KEM and ML-DSA add to a handshake and a certificate chain — and whether it still fits your MTU

Decoder Chains

Tool · Security

Unwrap nested base64, hex, URL, gzip and UTF-16LE layer by layer — and know when to stop

Base64

Tool · Security

Encode and decode Base64 strings instantly in the browser